Audits › HKUDS/Vibe-Trading › Coinbase
Bot × exchange
Does Vibe-Trading work with Coinbase?
The Vibe-Trading README does not name Coinbase directly, but it names ccxt, the exchange library that ships a Coinbase adapter. Whether the bot's own code handles Coinbase's rules (symbols, order types, rate limits) is not something a README scan can tell. We did not run the bot against Coinbase: this page reports what the public code says and what the exchange itself publishes.
Coinbase facts
- CoinGecko trust score
- 10 / 10 · rank 2
- Country
- United States
- Established
- 2012
- 24h volume (BTC, normalized)
- 0
- Puerto Rico residents
- Not verified: the eligibility page returned an access error (HTTP 403) on the check date (source, 2026-09-17)
- Derivatives
- Regulated futures through Coinbase Financial Markets; global perpetuals since June 2026 (source, 2026-09-17)
- Official API
- Yes (Advanced Trade API); futures access for U.S. territories not confirmed (source, 2026-09-17)
Exchange data: CoinGecko public API and the exchange's own endpoints, 2026-09-17. More on the Coinbase page.
What the audit says about running it live
From the Vibe-Trading audit (2026-09-17), the controls that matter most once a live API key is connected:
| Control | Verdict | Evidence |
|---|---|---|
| API key permissions | Partial | agent/src/trading/onboarding.py: explicit setup_hint text for several connectors, e.g. Binance 'Create a read-only Spot API key; do not enable withdrawals', OKX 'do not grant Trade or Withdraw permissions', Upbit 'do not grant withdrawal permission'. GET /search/code?q=withdraw+repo:HKUDS/Vibe-Trading+language:Python returned 10 hits, none inspected as an actual withdrawal API call |
| Orphaned stop-loss | Not verified | agent/src/live/mandate/model.py has no stop-loss field of any kind in HardCaps/Mandate |
| Websocket and data reconnection | Not verified | agent/src/market_data.py implements a multi-source REST fallback chain with bounded retries (max_fallback_attempts=5) for market data |
| Order rejection handling | Present | agent/src/live/order_guard.py _allow(): inspects the broker response envelope; an error envelope is audited as kind='order_rejected'/outcome='error' and does NOT increment the daily counter; class attribute 'repeatable = False' documented as 'a live order must never be silently re-issued' |
| Position reconciliation with the exchange | Not verified | agent/backtest/binance_account_reconciliation.py exists but lives under agent/backtest/ (shadow-account/backtest verification), not under agent/src/live/ |
Before you connect a key
- Create the API key with trading enabled and withdrawals disabled, and restrict it to your server's IP if Coinbase allows it.
- Start in paper or dry-run mode if the bot has one (the README mentions it).
- Decide the maximum loss per day before the first order and check the bot can enforce it: see the circuit breaker control. If it cannot, the watchdog enforces it from outside with a read-only key.